hxxp://helenasenators[.]sportngin[.]com

Analysis

max time kernel
600s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://helenasenators.sportngin.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
2420	msedge.exe
2420	msedge.exe
4152	identity_helper.exe
4152	identity_helper.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2864	2420	msedge.exe	83
PID 2420 wrote to memory of 2864	2420	msedge.exe	83
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4876	2420	msedge.exe	84
PID 2420 wrote to memory of 4264	2420	msedge.exe	85
PID 2420 wrote to memory of 4264	2420	msedge.exe	85
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86
PID 2420 wrote to memory of 4420	2420	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://helenasenators.sportngin.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc00204718
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7763069178790151681,16497352619646603277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
b3582912c2a020ddc01ed8a583e90a9d

SHA1
dba615efe9df40669ea4b44ddcf9ba939c42da85

SHA256
772e89f93360ae335efc67f477b348ca83c319cdf2e99e75caf718afa217ca4c

SHA512
78ac1587baaef82e4684ff3e7c318636c90488d4fd189d04a658f0322c26fb4c5cc002bb342e2101e09a220cc215cd8ebea7dc1efca69676a224d162e354e96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
acb4af1b96a1cb596518a4339f03df6d

SHA1
e02211bbdede42f7053e52d3589ba8e64768887e

SHA256
ec10ce5191744cb2299b440012a7fb720ecaf00aa52b18de23ad0d5ee8fd0ec0

SHA512
65db7de2580d3d7f978d540f1e09fdc9c3f5717b16a61eeec5836a86b7f86e22a3d7a3292deb41f33b0908b1b6820c52e7a2d95c83abf3b1e2bb4f98348003f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86f4cc8b6f4ad68500b36bfc15cd27ea

SHA1
201887a7285fc3b3ef848dc52ff835e76bcebf73

SHA256
5f5b3243f447f6705c7d6e17136cc4473bba7867f2f925fa078f80e09c11874b

SHA512
761941f0eafe385357e79332e259b7db9e770e511eed356dd72bcd60909311858d4f525411cf862fb253db7ddd4123addb83e25062849e3388f99cbeea86b604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ccd50aaa31168b05f6b7f5a32a7fb6e8

SHA1
0b9a3086b565375534d735aa20f0e6923183f94f

SHA256
6f43dd2b67c4c084b040249ca106167f1f54a3e1bb58cca401a6ce37cb64edee

SHA512
023f1388c716d36e791910f296d5fb8ca401f96bc795ccacc6dd902972b7e9dacb3b3e47c0a147062ca58668eda3a4bc3ef1a549adc9004b22d4478947a827d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fbb038dd328e56234906749526700ba7

SHA1
86270d95e0baf680a69f49b18554f49bc679ab58

SHA256
00f0c21ef5335b42e62060b162285f218486b31c6573a51b7b65e6272358e867

SHA512
2fc5fd4940e1a2d3f51d3e820b2f2b066cc742b3d0a1ca189d5222f92373d8525008ce7ee1c077f2e12b01f3f70ced0ddef2e7070d61ed55b82548ca9d2fef65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa4e398feec567c9bcbf3161920446a7

SHA1
1177aad6a63c8eff37d6fb2a6e1c6db6d3510b78

SHA256
ec1c45483e95d79fc1405ead51cdb528077f5c0a9ee47007f4ab264375af7f04

SHA512
20266d77dc9f9e92621c95ad330ee04ea1285048e46c3c8f1bff0da7ffa5ad162c48909d026aa69dcf60d7c9f4835f2779c30c3452cf9e5c91107bea07db8a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ad09.TMP

Filesize
1KB

MD5
5c1b9a38dafa64ca6c1114589aa2f4eb

SHA1
c6d3effed494faa8727d26e8ee29f42fc30f67c3

SHA256
8d26ec5c6a56b171e44b8f516c48752bfe2963029ccce46929b6053f6bcfbb37

SHA512
4888b57c0b8d00cfa3fb1557f86f62eb7bae836354b285eb6b1eaad0640e073103203dc8bee9d0e4516894519104f19766789f1cadbb8243c7b90b4fd082031f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4164d6165168f9351fad74971897bc3

SHA1
402152cb6cbf4d5f94e34776e3e64ce14295d55a

SHA256
268532555bafaf64ddf8e5fe1307e875058bcb8f8cd6f591139273bbcbe0cfc0

SHA512
a16988a425f2c3bcd248c0af64e61038a6bb675f5d2d2d04da910dc8636ccdf24e55e9eb320f6a5b7dba3aed2e8c72bbd1190e439a25138f80f9d3c60318de29

Download Submit